m.z1oxncm.cn/200eaEZxBEBnfUUGRxQTRHdYBHxQdgNdCkJRC3oqGAcTVQkgSDBfEjsfJlotCB5OF1QrelJddRIdMQQKC0U7YQkubGADZz4G&p=lookms1671200943807
172.67.199.152200 OK 429 B URL HTTP/1.1 m.z1oxncm.cn/200eaEZxBEBnfUUGRxQTRHdYBHxQdgNdCkJRC3oqGAcTVQkgSDBfEjsfJlotCB5OF1QrelJddRIdMQQKC0U7YQkubGADZz4G&p=lookms1671200943807
IP 172.67.199.152:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with CRLF line terminators
Hash 5bd6017f379d1d12b06c4087d592ecf4
96f3eec6cef3a0aae7618ccc050fa88824e2a52b
e43bf84afb522696d222ef75bf4588fa2ee325c7aa0e384b30bc390f18632dcb
GET /200eaEZxBEBnfUUGRxQTRHdYBHxQdgNdCkJRC3oqGAcTVQkgSDBfEjsfJlotCB5OF1QrelJddRIdMQQKC0U7YQkubGADZz4G&p=lookms1671200943807 HTTP/1.1
Host: m.z1oxncm.cn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Fri, 16 Dec 2022 15:18:31 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: POST,GET,OPTIONS
Access-Control-Allow-Headers: X-Requested-With,X_Requested_With,X-PINGOTHER,Content-Type
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kjfNRH7bpzEXl%2Fq5%2BmrQTj%2Bgxv089dK5Uxp6oncGzxNVTg8PO0GzGZaS45BbunzRw2GlH%2B1S2VN6VEtBgobtpKpnCjQ1RB32xbGjVdYPkdpjCYEHv80uhbaWzwpYrjU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 77a8645ffbe9b4f7-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 381442da2a14cb93770f4c8f6e19d35b
31c48467751e2450a63004c57eea0c7872023eaf
61b0985f47033bd7020ab3b8cdcbc6c17be6ab9b6feba69e006088b78e21c0f0
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "61B0985F47033BD7020AB3B8CDCBC6C17BE6AB9B6FEBA69E006088B78E21C0F0"
Last-Modified: Thu, 15 Dec 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=9045
Expires: Fri, 16 Dec 2022 17:49:16 GMT
Date: Fri, 16 Dec 2022 15:18:31 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 4a5e9bc8b7891ac5f4552c29bcbaedb0
39735081eeb64eae477c61c1147daeb68fb37b22
c465efaf205ff2992af02c16187ca14a658cd5335b892903374f3adab32a8cd9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "C465EFAF205FF2992AF02C16187CA14A658CD5335B892903374F3ADAB32A8CD9"
Last-Modified: Thu, 15 Dec 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4866
Expires: Fri, 16 Dec 2022 16:39:37 GMT
Date: Fri, 16 Dec 2022 15:18:31 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
35.241.9.150200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash bf0c602d32b3c14606f22a86183b5e3c
6eabd8d83475eba731968abe1a05a8bfd272f160
6c6a7c519a9e950c2445ed874a25211a94dd4d3cf3afb0103af9dcd1dbd5ff9e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Content-Length, Content-Type, Retry-After, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Fri, 16 Dec 2022 14:45:10 GMT
content-type: application/json
age: 2001
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 51bd0cc75ed746fd33c950eb12936b7e
4a1007ea6c6e4f5e8b4a7d1f85f7a3e329dc8f50
188d4a0d544f40048dc7476cb4f5e478f1eb49a8ef1d51699fb155d2ae258655
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "188D4A0D544F40048DC7476CB4F5E478F1EB49A8EF1D51699FB155D2AE258655"
Last-Modified: Tue, 13 Dec 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5940
Expires: Fri, 16 Dec 2022 16:57:31 GMT
Date: Fri, 16 Dec 2022 15:18:31 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 53341dea33f4f3d9b4966f80589f429a
20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: PNUKx6wOjNvZaEZa3GYbQubRaegglDQe6igYByoY4BfVNgnoY4npO/T/qXDu1NreBfCJ2W41EpQ=
x-amz-request-id: TMBJNJYGE89C45BZ
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Fri, 16 Dec 2022 14:53:17 GMT
age: 1515
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 16 Dec 2022 15:18:31 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/s/gts1p5/tOROFlXVzpw
142.250.74.131200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/tOROFlXVzpw
IP 142.250.74.131:0
Hash 8512abcc2759b818196df2f6199e123a
f58eb83e091f2617e8493322de3de714b712bdf0
0e3904349343cc957b96633c70c716905ac9a418d11a2234dd6f97530203ed4d
POST /s/gts1p5/tOROFlXVzpw HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/s/gts1p5/tOROFlXVzpw
142.250.74.131200 OK 472 B URL HTTP/1.1 ocsp.pki.goog/s/gts1p5/tOROFlXVzpw
IP 142.250.74.131:0
Hash 8512abcc2759b818196df2f6199e123a
f58eb83e091f2617e8493322de3de714b712bdf0
0e3904349343cc957b96633c70c716905ac9a418d11a2234dd6f97530203ed4d
POST /s/gts1p5/tOROFlXVzpw HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.digicert.com/
93.184.220.29200 OK 278 B IP 93.184.220.29:0
Hash 6a42c44f0886d03c0912102130355124
f89d54b2eb051b73d182d7f2401c3029efdb9cbb
a2613f1393caef232c6e0db80dbc6118aa9b267a6838ecbbd013e9981e173fa3
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5183
Cache-Control: max-age=98115
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Etag: "639b544c-116"
Expires: Sat, 17 Dec 2022 18:33:47 GMT
Last-Modified: Thu, 15 Dec 2022 17:07:24 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 278
ocsp.digicert.com/
93.184.220.29200 OK 278 B IP 93.184.220.29:0
Hash 6a42c44f0886d03c0912102130355124
f89d54b2eb051b73d182d7f2401c3029efdb9cbb
a2613f1393caef232c6e0db80dbc6118aa9b267a6838ecbbd013e9981e173fa3
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5183
Cache-Control: max-age=98115
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Etag: "639b544c-116"
Expires: Sat, 17 Dec 2022 18:33:47 GMT
Last-Modified: Thu, 15 Dec 2022 17:07:24 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 278
ocsp.digicert.com/
93.184.220.29200 OK 278 B IP 93.184.220.29:0
Hash 6a42c44f0886d03c0912102130355124
f89d54b2eb051b73d182d7f2401c3029efdb9cbb
a2613f1393caef232c6e0db80dbc6118aa9b267a6838ecbbd013e9981e173fa3
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 921
Cache-Control: max-age=93853
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Etag: "639b544c-116"
Expires: Sat, 17 Dec 2022 17:22:45 GMT
Last-Modified: Thu, 15 Dec 2022 17:07:24 GMT
Server: ECS (amb/6BBE)
X-Cache: HIT
Content-Length: 278
ocsp.digicert.com/
93.184.220.29200 OK 278 B IP 93.184.220.29:0
Hash 6a42c44f0886d03c0912102130355124
f89d54b2eb051b73d182d7f2401c3029efdb9cbb
a2613f1393caef232c6e0db80dbc6118aa9b267a6838ecbbd013e9981e173fa3
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4455
Cache-Control: max-age=97387
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Etag: "639b544c-116"
Expires: Sat, 17 Dec 2022 18:21:39 GMT
Last-Modified: Thu, 15 Dec 2022 17:07:24 GMT
Server: ECS (amb/6B74)
X-Cache: HIT
Content-Length: 278
cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.1.1/css/all.min.css
151.101.1.229200 OK 21 kB URL HTTP/2 cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.1.1/css/all.min.css
IP 151.101.1.229:0
File type ASCII text, with very long lines (65317)
Hash b5ae87c0e4dd241b533e67053b0b719d
6b7b568694a95d81a94dea9ef7a85d1317d448dc
5bae5997fbca925ac6e52be8163ca897e751fcc9331552e0f77a22dd35b64521
GET /npm/@fortawesome/fontawesome-free@6.1.1/css/all.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 6.1.1
x-jsd-version-type: version
etag: W/"189ae-CRAs/GDvtDCiXul87ppqNd9t/Fk"
content-encoding: gzip
accept-ranges: bytes
date: Fri, 16 Dec 2022 15:18:32 GMT
age: 3860025
x-served-by: cache-fra-eddf8230116-FRA, cache-bma1666-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 20556
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 278 B IP 93.184.220.29:0
Hash 6a42c44f0886d03c0912102130355124
f89d54b2eb051b73d182d7f2401c3029efdb9cbb
a2613f1393caef232c6e0db80dbc6118aa9b267a6838ecbbd013e9981e173fa3
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4081
Cache-Control: max-age=97013
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Etag: "639b544c-116"
Expires: Sat, 17 Dec 2022 18:15:25 GMT
Last-Modified: Thu, 15 Dec 2022 17:07:24 GMT
Server: ECS (amb/6BC8)
X-Cache: HIT
Content-Length: 278
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 8cffeaa037aa43ee5dd38d9bf940f0ec
385130d35323155499a61e73e16a9d9e7a6448b5
2938e838bf98de278488e22b736756400136c887e31b44fc608c4da2a07e6ae4
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/css/select2.min.css
151.101.1.229200 OK 2.2 kB URL HTTP/2 cdn.jsdelivr.net/npm/select2@4.1.0-rc.0/dist/css/select2.min.css
IP 151.101.1.229:0
File type ASCII text, with very long lines (16263)
Hash bd3ea59ca12635e32402ec20cb196249
b1bfdaba4a00c2932245ff9eabea38016f9c9069
b99f8f79de257275fdbf6a8e0eb4652b0d69429552234b1f444c08ae85000341
GET /npm/select2@4.1.0-rc.0/dist/css/select2.min.css HTTP/1.1
Host: cdn.jsdelivr.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 4.1.0-rc.0
x-jsd-version-type: version
etag: W/"3f88-kT+fe5U1rseQyjzp1uNaz682mZM"
content-encoding: gzip
accept-ranges: bytes
date: Fri, 16 Dec 2022 15:18:32 GMT
age: 22624418
x-served-by: cache-fra19146-FRA, cache-bma1666-BMA
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 2162
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 278 B IP 93.184.220.29:0
Hash 6a42c44f0886d03c0912102130355124
f89d54b2eb051b73d182d7f2401c3029efdb9cbb
a2613f1393caef232c6e0db80dbc6118aa9b267a6838ecbbd013e9981e173fa3
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 5183
Cache-Control: max-age=98115
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Etag: "639b544c-116"
Expires: Sat, 17 Dec 2022 18:33:47 GMT
Last-Modified: Thu, 15 Dec 2022 17:07:24 GMT
Server: ECS (ska/F711)
X-Cache: HIT
Content-Length: 278
utupkf.cyou/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
172.67.183.174200 OK 2.1 kB URL HTTP/2 utupkf.cyou/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
IP 172.67.183.174:0
Hash 05170d58a409ce6d288b6eccbe37f7ae
7d2b82cad2da7fef57a3182e129a612a7210f51d
99715cabcaecb8759b83d3bd3987130615aa5d1ee0d33be5f77b85a4c803b9d9
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1
Host: utupkf.cyou
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/WUJUAmhv/rossmannpl-maq2022/?_t=1671203911741lookms1671200943807
Cookie: pType=mo
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: application/javascript
last-modified: Wed, 14 Dec 2022 12:21:11 GMT
etag: W/"6399bfb7-4d7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xt3xfplMFcPiyQ8cFUkufyi5qPFlEiJII0RCqA6QF5txZCbpapgUD7d69jvrCHtEtY7VOOwFGFWsLiWkbOasLczt2W66QVQcO76ZuX1QJXpCYO%2BncCA1ssksNN1Hhw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a864643d37b524-OSL
x-frame-options: DENY
x-content-type-options: nosniff
expires: Sun, 18 Dec 2022 15:18:32 GMT
cache-control: max-age=172800, public
content-encoding: gzip
X-Firefox-Spdy: h2
e1.o.lencr.org/
23.33.119.27200 OK 345 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash b54bf9e0002f097d1febc358bccc5453
5fa732fa887dd41ac90113dd680d57976eb19677
cd4cded2cc7e36324a82d71f4a3456d0d22bfa3ac2d36507fbc638900570f4f9
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "CD4CDED2CC7E36324A82D71F4A3456D0D22BFA3AC2D36507FBC638900570F4F9"
Last-Modified: Thu, 15 Dec 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13906
Expires: Fri, 16 Dec 2022 19:10:18 GMT
Date: Fri, 16 Dec 2022 15:18:32 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 9071a6ce80e8cdef90916a0f6651353a
2c2e39523e0ccfd4a319f9895822e195d4eb86bb
97c4124c32ba9a54770b8caaf74281d720542cf9d2d6c695f3f6bedf08a46bc4
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "97C4124C32BA9A54770B8CAAF74281D720542CF9D2D6C695F3F6BEDF08A46BC4"
Last-Modified: Thu, 15 Dec 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20817
Expires: Fri, 16 Dec 2022 21:05:29 GMT
Date: Fri, 16 Dec 2022 15:18:32 GMT
Connection: keep-alive
e1.o.lencr.org/
23.33.119.27200 OK 346 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 439abd0da745dff868023e4e06352d07
8b31bb240c46b32c29d70b9c6b6bd4968e0efabf
255fbdec7c6936a59e22531c7b11d54d2390fa139d054d18f341508f2faabbe6
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "255FBDEC7C6936A59E22531C7B11D54D2390FA139D054D18F341508F2FAABBE6"
Last-Modified: Thu, 15 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18935
Expires: Fri, 16 Dec 2022 20:34:07 GMT
Date: Fri, 16 Dec 2022 15:18:32 GMT
Connection: keep-alive
cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
172.67.151.125200 OK 32 kB URL HTTP/2 cdn.jsdelivr.cc/npm/jquery@3.6.0/dist/jquery.min.js
IP 172.67.151.125:0
File type ASCII text, with very long lines (65446), with CRLF line terminators
Hash 8bbb93570a7365783edcd996eba4b7fd
d6126911681eb7484fa2e7d3f12b86b66bfff420
0fd7c43eed66c683d69018d422df8e2a5e3126163c0a7504ffddfe01c2c71c98
GET /npm/jquery@3.6.0/dist/jquery.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycdujKqP4OmsICcw4by2ej4M3gF2bmp67KcND5Yd7ZkChGu92L3U7j930k4J7s5KmD98KzStiLKDZt_7_8jjTVv4
expires: Fri, 16 Dec 2022 15:15:31 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:30:17 GMT
etag: W/"3e4bb227fb55271bfe9c9d4a09147bd8"
x-goog-generation: 1647502217775195
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 89501
x-goog-hash: crc32c=JnXAUA==, md5=PkuyJ/tVJxv+nJ1KCRR72A==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2339
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=82pN4qiPwJoIxl0KVJvYisM96Z%2FEQZlkZZqcMWDl9DMZtpsjyWdSJjP32U59Ow6G%2B8yFYJMqHVavQZNjwVBpbOIBYwsXVEa9jHegH1llfb50zXvs6JW2ncVQqox%2FmF0iQbU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86464dedc0b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
e1.o.lencr.org/
23.33.119.27200 OK 346 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 439abd0da745dff868023e4e06352d07
8b31bb240c46b32c29d70b9c6b6bd4968e0efabf
255fbdec7c6936a59e22531c7b11d54d2390fa139d054d18f341508f2faabbe6
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "255FBDEC7C6936A59E22531C7B11D54D2390FA139D054D18F341508F2FAABBE6"
Last-Modified: Thu, 15 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18985
Expires: Fri, 16 Dec 2022 20:34:57 GMT
Date: Fri, 16 Dec 2022 15:18:32 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 0d73d5422599531ed89c2eb046ae6d8d
aac2f93511367405370fb6d69ec0a404c5903718
7ccd935f876d67f1da32b45f81ec4e81a76d7db490b9407490f6de24d14bed18
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
263cdn.com/upload/heksbnshjadss.jpg
172.64.198.12200 OK 11 kB URL HTTP/2 263cdn.com/upload/heksbnshjadss.jpg
IP 172.64.198.12:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x150, components 3\012- data
Hash 1b0db11bb9835c15187b810c23cb279b
4abe172d5e5535eb047313616e1258d154323520
6907128ddfd0a6288a28b68352a7d23e46dac5d37acec8951248acae4dbfaf6d
GET /upload/heksbnshjadss.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 10680
x-guploader-uploadid: ADPycdt3msTnjevx4he7aOZze1deH7KpSdoJg1_C6ZWXi_TQqZEUHJtRKG0BFQn0ITrRAksqgr4SnchMkCCMCfgQe0JoS7DPl_mP
expires: Fri, 16 Dec 2022 15:20:03 GMT
cache-control: public, max-age=14400
last-modified: Wed, 15 Jun 2022 21:54:19 GMT
etag: "1b0db11bb9835c15187b810c23cb279b"
x-goog-generation: 1655330059597147
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 10680
x-goog-hash: crc32c=qRB8kQ==, md5=Gw2xG7mDXBUYe4EMI8snmw==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 243
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P7B%2BhtVe6rcwvFPCjIWbVYRSYtaKh2ncji3CIfmzU4w8%2FKXNR0P%2Fc79Ol5XninFZ4LHgGGShiSV%2BX9I7kcbltZ83YcGz05bCyYXE5K4M3EsMZWMe0fti8qTo1DiG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a864666983750d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnbun.com/upload/circlek2022-box3.png
172.64.164.25200 OK 28 kB URL HTTP/2 cdnbun.com/upload/circlek2022-box3.png
IP 172.64.164.25:0
File type PNG image data, 280 x 202, 8-bit/color RGBA, non-interlaced\012- data
Hash 488593a16b93e295cbf1b620494bdfb7
62958a134099b90a589029718d14424cc66d3bf8
7e244493059a0294b42f93b3fb6cb3912ecc6640490018d1b4a8c9e4aee90758
GET /upload/circlek2022-box3.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/png
content-length: 28423
x-guploader-uploadid: ADPycdvC3SJnu79WmgsBEsLYGVEgl_LEGFxfUvcZ5OWDauxhVxdTqMCd2oxK4IqSuimXWBKFI4l5r1SVbuzQj3IDpZEbrw
x-goog-generation: 1668579688559640
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 28423
x-goog-hash: crc32c=JPTXAw==, md5=SIWToWuT4pXL8bYgSUvftw==
x-goog-storage-class: STANDARD
expires: Fri, 16 Dec 2022 14:30:18 GMT
cache-control: public, max-age=14400
last-modified: Wed, 16 Nov 2022 06:21:28 GMT
etag: "488593a16b93e295cbf1b620494bdfb7"
cf-cache-status: HIT
age: 2375
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1PxaRT6ftj4XGkLM2wvOfz087j85RCwSuKpNLNp0imyXensrz3rn3v9C415TBtgwmaZWwzDmWgAKq4QmU2aBWrOukotpBswx3K6volbcGCYhNUoEiluSDfxH2CaX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a864667d4571d2-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/healsd.jpg
172.64.198.12200 OK 11 kB URL HTTP/2 263cdn.com/upload/healsd.jpg
IP 172.64.198.12:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x150, components 3\012- data
Hash caf2813a281798cb0aa8d3ea8085b2ad
d78ac2798f925b8672d190c6ffc1e47a94ff7484
2a51cd0b99fdf6d9a20fa8f799ad90e2b570745d50decd48a872f4b5c5cd1883
GET /upload/healsd.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 10576
x-guploader-uploadid: ADPycdtOT24wHAqFTUOIYM6M4wco2zf4yf7OWYoZol9RfJoIA9BCntW39E9ifipAOyoc2PaXZFTy38KAIK9Et2TZHvVAc6n8gLut
expires: Fri, 16 Dec 2022 15:20:05 GMT
cache-control: public, max-age=14400
last-modified: Wed, 15 Jun 2022 21:54:18 GMT
etag: "caf2813a281798cb0aa8d3ea8085b2ad"
x-goog-generation: 1655330058795462
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 10576
x-goog-hash: crc32c=s5B2nQ==, md5=yvKBOigXmMsKqNPqgIWyrQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 944
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JOsngc7UUpSCD8MYybECjQDx5vYug6bttbGos2nd2g%2Bo1yQMJUsQbGYquaHB5b%2BlF2LjmhFNYi6SBcKIorsxJvYh0tz2yYOOfjG6nWH%2F59eJseQoiHGmntpVwUPP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86466799b750d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnbun.com/upload/circlek2022-left.png
172.64.164.25200 OK 949 B URL HTTP/2 cdnbun.com/upload/circlek2022-left.png
IP 172.64.164.25:0
File type PNG image data, 7 x 80, 8-bit/color RGBA, non-interlaced\012- data
Hash b8959f65b4fd9f5bde3704d9a640811b
b5674c20bde951a6071252e8e4dfbcd129136fc4
7df0c0f2bff1160cf2efeb355c510668ca0df9b8061b83a935f4f9ed61120243
GET /upload/circlek2022-left.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/png
content-length: 949
x-guploader-uploadid: ADPycdvlOOovvxu9UpJauX3FK5Hu7lVyQqrY3FO-B7zvEUKyEPcmSlmoJgWh6WANhmcQrCTTgMkJU7adKPD0Ipy2HIjAXg
x-goog-generation: 1668579689420950
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 949
x-goog-hash: crc32c=jC7o7A==, md5=uJWfZbT9n1veNwTZpkCBGw==
x-goog-storage-class: STANDARD
expires: Fri, 16 Dec 2022 15:06:48 GMT
cache-control: public, max-age=14400
last-modified: Wed, 16 Nov 2022 06:21:29 GMT
etag: "b8959f65b4fd9f5bde3704d9a640811b"
cf-cache-status: HIT
age: 1214
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yak5ORyN0ZwqT4oag07ELhkvdCEFLBcADkzRQmfMZ6LaTQdqpeUJCa%2FVVU5sGUXyWGOolEMoZOcFqaPH0U6Jzm6P8IKoiKwgvKBB3%2FNadwzAuICQLWqMsXk%2FrrKj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a864668d6171d2-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/dssdfool.jpg
172.64.198.12200 OK 9.4 kB URL HTTP/2 263cdn.com/upload/dssdfool.jpg
IP 172.64.198.12:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x150, components 3\012- data
Hash 84b46c32ef16f2996dd843db2a8cc63b
1406bdb9bb9c4f11656e7c493d3c4f84e4eaa2f1
d952fcecd652cfc86c50b0e983ef70c2a447b4dba8183269c7fe08b2421e56d4
GET /upload/dssdfool.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 9402
x-guploader-uploadid: ADPycdtzL9mL_sSI1o7pQYNbxwvDc23diOF-OERZKFJzRZgsXRePva1hB02KxKuxGlMau0UfDbSiv4_j69sseMFnKGU92RRSDnl-
x-goog-generation: 1655329940736944
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 9402
x-goog-hash: crc32c=uNaIYw==, md5=hLRsMu8W8plt2EPbKozGOw==
x-goog-storage-class: STANDARD
expires: Fri, 16 Dec 2022 15:39:32 GMT
cache-control: public, max-age=14400
last-modified: Wed, 15 Jun 2022 21:52:20 GMT
etag: "84b46c32ef16f2996dd843db2a8cc63b"
cf-cache-status: HIT
age: 2340
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=16rjNyEby4qNGvD4%2FmDu3jMq2hzcsOR7vPaGv5Sd4f3rIbnMPZpy2W5vmhtDIQMG5JeNjV%2B36si7Lb3LYjPxHvRXzaTS7pziETnv3trnlPfCDUOm1lmmI0yDRBvH"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a864667997750d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/heksbnshjadd.jpg
172.64.198.12200 OK 12 kB URL HTTP/2 263cdn.com/upload/heksbnshjadd.jpg
IP 172.64.198.12:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x150, components 3\012- data
Hash 996db8fb0401a5498dfbedee1daf41e5
b7efb0602b1aeabfcb1a9eea4ce88f3c0f62b841
b6d0f9395da179a0d7c62e60536179b936e9abae4b1ae60f0734a22d1bc74a4f
GET /upload/heksbnshjadd.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 12007
x-guploader-uploadid: ADPycdswTOGgrLjsdr9BySeFtSXt5t7nStA9PPvP-DAB5HxUbglVwbSHBk4DAl8_FQquyQ8DTfnXDJPx0V8-0s9pqeSK8rN2LLfr
expires: Fri, 16 Dec 2022 15:43:03 GMT
cache-control: public, max-age=14400
last-modified: Wed, 15 Jun 2022 21:54:19 GMT
etag: "996db8fb0401a5498dfbedee1daf41e5"
x-goog-generation: 1655330059547576
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 12007
x-goog-hash: crc32c=fk2ILg==, md5=mW24+wQBpUmN++3uHa9B5Q==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 645
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JUOGzZmS%2BFDnP6FrHN5MOptS5B6V4z7NdEHvdp9khYnsXmRIdkFptDTt6pFf%2FVTX1sETzAksHcC2dyKwWqUyTUQ9kmDuEnXbyfF3oRQHASqlWktRaWLtWoKZ2poW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a864667994750d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/heksbnshjad.jpg
172.64.198.12200 OK 12 kB URL HTTP/2 263cdn.com/upload/heksbnshjad.jpg
IP 172.64.198.12:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x150, components 3\012- data
Hash de97fc751d5287d8e03c94ad9a8a1d0e
da53fe59265dbc2a9c735e922404d46b992beab4
dff803e78263a110416282bc5881493a87dd5b86716c7e19b5541f06d29de790
GET /upload/heksbnshjad.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 12335
x-guploader-uploadid: ADPycdt5W3xjPuK3OTqosETMq3cadCH8yiEY3G6GpqbzaVhnEZ4AKvzERXWGFFu_qSfF1fZbTsXYgbs2SOlpb0RasX4utQ
expires: Fri, 16 Dec 2022 14:06:52 GMT
cache-control: public, max-age=14400
last-modified: Wed, 15 Jun 2022 21:54:19 GMT
etag: "de97fc751d5287d8e03c94ad9a8a1d0e"
x-goog-generation: 1655330059487233
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 12335
x-goog-hash: crc32c=OXm3Rg==, md5=3pf8dR1Sh9jgPJStmoodDg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 1107
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0bK7kRWx7hQ53M6e6JP6K1AOZE%2B9soUYKS1qXA%2FO1WK0dbEebxEf5Eay7spNvC%2BYnj2igsl5zYukucMKHT6Eyp9jjxF9hPM8ZULbhyiBwKx8W8R8eUcqBkiyAVFm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a864667998750d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 0d73d5422599531ed89c2eb046ae6d8d
aac2f93511367405370fb6d69ec0a404c5903718
7ccd935f876d67f1da32b45f81ec4e81a76d7db490b9407490f6de24d14bed18
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
263cdn.com/upload/dhjsxioa.jpg
172.64.198.12200 OK 9.2 kB URL HTTP/2 263cdn.com/upload/dhjsxioa.jpg
IP 172.64.198.12:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x150, components 3\012- data
Hash d5ea96366f71fca02f729fae16e5158c
d5c41c7dc5bca1a60c05cdaa9d5c88ee379eec5f
f74645d776ba7f4fec1e9ae2813fc8d56c51b1038e9fbd7e5c5a9dfd92ba0d8e
GET /upload/dhjsxioa.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 9197
x-guploader-uploadid: ADPycdtVbagZz3iRaRaoaxOfYHLNFgq3IzbbqIze6gqjukOij_ObsIyEBpQcnANkdnpXZLpb8b8jgzE3ItY5G2JtCZLyNw
expires: Fri, 16 Dec 2022 15:33:05 GMT
cache-control: public, max-age=14400
last-modified: Wed, 15 Jun 2022 21:51:55 GMT
etag: "d5ea96366f71fca02f729fae16e5158c"
x-goog-generation: 1655329915029058
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 9197
x-goog-hash: crc32c=4nTVHw==, md5=1eqWNm9x/KAvcp+uFuUVjA==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 938
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CoPuQjbp1VlfobpwS4tvaIi%2FZqjUOx1znpsfQmi9oucAINbHQYRRvR4otI%2FG9ti3JMnAdZt3d0Y16nN0gOnVhR33JWdyMdEUP%2FW8HEHIxej5rDeY5NqBa61AVLWc"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a864667999750d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
1.bp.blogspot.com/-T_4FPQJDXos/YKsjbNLDpRI/AAAAAAAABho/lE-RXu-La9UZUtmJisWFGBB7Gyzc2-M_QCLcBGAsYHQ/s16000/Norway_inbox.png
142.250.74.161200 OK 14 kB URL HTTP/2 1.bp.blogspot.com/-T_4FPQJDXos/YKsjbNLDpRI/AAAAAAAABho/lE-RXu-La9UZUtmJisWFGBB7Gyzc2-M_QCLcBGAsYHQ/s16000/Norway_inbox.png
IP 142.250.74.161:0
File type PNG image data, 350 x 251, 8-bit colormap, non-interlaced\012- data
Hash ff055162c5d233506eece3fb69a47e74
49812e303ae6674819b6a7a6e0721d555ef64df4
7e46c8bcf219a0d6f0f3d5c5b027ed613678a0c54d637172d6495f428ff80150
GET /-T_4FPQJDXos/YKsjbNLDpRI/AAAAAAAABho/lE-RXu-La9UZUtmJisWFGBB7Gyzc2-M_QCLcBGAsYHQ/s16000/Norway_inbox.png HTTP/1.1
Host: 1.bp.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
content-disposition: inline;filename="Norway_inbox.png"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
server: fife
content-length: 13695
x-xss-protection: 0
date: Fri, 16 Dec 2022 14:23:18 GMT
expires: Sun, 06 Nov 2022 03:02:48 GMT
cache-control: public, max-age=86400, no-transform
age: 3314
etag: "v630"
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
cdnbun.com/upload/rossmannpl-show2.jpg
172.64.164.25200 OK 59 kB URL HTTP/2 cdnbun.com/upload/rossmannpl-show2.jpg
IP 172.64.164.25:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 450x395, components 3\012- data
Hash 1a04d72ece985781516cdab55df13a55
524e7f3764c77ea6f87b1ac25895f0b5ea0d4df0
112e39eccc469bbae2c31c2a72165749e24391d2b38a912ca7bcb530d8ca4716
GET /upload/rossmannpl-show2.jpg HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 59212
x-guploader-uploadid: ADPycdtphAFxdkI98IrUTmLc-6dfKh5nHNSHJXIB6KTBDazieD1TbA4rrNyckorPIZr1DF4BihyrKnOUKQBE4HLKwNUmqw
expires: Fri, 16 Dec 2022 14:31:40 GMT
cache-control: public, max-age=14400
last-modified: Fri, 25 Nov 2022 12:51:03 GMT
etag: "1a04d72ece985781516cdab55df13a55"
x-goog-generation: 1669380663779280
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 59212
x-goog-hash: crc32c=jaCt3A==, md5=GgTXLs6YV4FRbNq1XfE6VQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3376
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cy73kyCLrbWMlsz9MZUXKZiO4r5luiLife6xpEevZVXOyKrkqn2IDMHAL5DWfq3Q8vsWFmEZrKLG1YF5lyNj2g9%2Blnzr%2FyGB6CS0ASgc0NszFjSOeNx3bBCrRb8v"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a864669d6771d2-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
35.241.9.150200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Alert, Cache-Control, Backoff, Content-Length, Content-Type, Last-Modified, ETag, Expires, Retry-After, Pragma
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Fri, 16 Dec 2022 14:33:23 GMT
age: 2709
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
cdnbun.com/upload/circlek2022-box1.png
172.64.164.25200 OK 30 kB URL HTTP/2 cdnbun.com/upload/circlek2022-box1.png
IP 172.64.164.25:0
File type PNG image data, 280 x 202, 8-bit/color RGBA, non-interlaced\012- data
Hash 8fa3098b9b9a4b956898a03f566c6b84
fe557ce64af0b97f2dcfa00e43968ee871ce78e5
6d2dadfa6ded951ac3b94b6575dacf8ca4df9b40eec8946cfc02ab7320e8f086
GET /upload/circlek2022-box1.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/png
content-length: 29910
x-guploader-uploadid: ADPycdtNPGX3mWM4tGTyKHz8ADX5z8xVOamEQidjJfg-0TEsQyiDJzWE2S72SlYoRU9Jks5A-3aBum_EQJMvq9VcE-LBQg
x-goog-generation: 1668579688415834
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 29910
x-goog-hash: crc32c=9bpMUQ==, md5=j6MJi5uaS5VomKA/VmxrhA==
x-goog-storage-class: STANDARD
expires: Fri, 16 Dec 2022 15:18:30 GMT
cache-control: public, max-age=14400
last-modified: Wed, 16 Nov 2022 06:21:28 GMT
etag: "8fa3098b9b9a4b956898a03f566c6b84"
cf-cache-status: HIT
age: 2375
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rYz%2Bujyw%2FiLAqBFyHaXJ%2B2Q%2Bpc9mHcJJOerDuFAOuxudhHK0J93hQzvUtofaKWVY4xabhwZHwXzFcyPttQFEnRj3dojhxWBMt%2BjXp8t2FCarzG%2F7xMj3%2BkLWbPrU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86466ad7a71d2-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/halzz.jpg
172.64.198.12200 OK 11 kB URL HTTP/2 263cdn.com/upload/halzz.jpg
IP 172.64.198.12:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x150, components 3\012- data
Hash 9fe7a6f60c094878dd8306ee07f2ac24
06fbb3bcd32d01df7783ce73575796d79bbcc402
b2379c4e20f74cf3d2f63867f0fef183757f1b46b9e231670064fd773ce92f48
GET /upload/halzz.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 11177
x-guploader-uploadid: ADPycdsd97Dvkliy3REBblawAzhA4AocSm47bdMhTKnsnD3Ua_MR7NnBCQd1mtXEWCu0zcDx9OLkB3jQ-qgUOepOIsTN5Q
x-goog-generation: 1655330052030265
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 11177
x-goog-hash: crc32c=to6Dcw==, md5=n+em9gwJSHjdgwbuB/KsJA==
x-goog-storage-class: STANDARD
expires: Fri, 16 Dec 2022 15:16:54 GMT
cache-control: public, max-age=14400
last-modified: Wed, 15 Jun 2022 21:54:12 GMT
etag: "9fe7a6f60c094878dd8306ee07f2ac24"
age: 1360
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O1CjI%2Bp%2BC9BTywUDxwY0SNG%2B51bJfYVgl%2B%2B1b30tXkPVRcnVt3SKXkXJw8hwpQcYOQzs75duwOvW7iiqG6pgsj8ZkvaHluw6njt0sKF2gvxnMdqklS3movIdL%2Fal"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86466c9e5750d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
172.67.151.125200 OK 26 kB URL HTTP/2 cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/css/bootstrap.min.css
IP 172.67.151.125:0
File type ASCII text, with very long lines (65321), with CRLF line terminators
Hash edb79674b876b12ecacb0a9617ded6bf
1612773b53f2e222ea580b031d12f92dfe712ab7
42ba76e1e898ae66deec5830183b18ba096896a8cd564640b526705dd74ebd71
GET /npm/bootstrap@4.6.0/dist/css/bootstrap.min.css HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: text/css
x-guploader-uploadid: ADPycduCHwg6n53VPzNb_-57qJzhoPJbEBdMgpsWgTX19t4NIh3Tdte6MCXenDGQTAuiJrpSRG3G9WDZErClLNvZVXhXccOSWw
expires: Fri, 16 Dec 2022 15:39:27 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:38:12 GMT
etag: W/"feba0d0760607b9e21393156949afcd9"
x-goog-generation: 1647502692716912
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 161415
x-goog-hash: crc32c=Sb/HMQ==, md5=/roNB2Bge54hOTFWlJr82Q==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2338
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1rYtf6G4D5Utc9E6eTGRJIEqdA%2BrkNdvx1%2FXoN4TWzSBMPD8iEbm9I9QqDSYbI0R3zpTtOEr3pnTMDyaqPjudMdnjoY%2BalheJjAkZIziZDSIGpyuMsZGo9xwjT1v76dT35Y%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a864649e910b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnbun.com/upload/circlek2022-box2.png
172.64.164.25200 OK 3.5 kB URL HTTP/2 cdnbun.com/upload/circlek2022-box2.png
IP 172.64.164.25:0
File type PNG image data, 280 x 202, 8-bit/color RGBA, non-interlaced\012- data
Hash f64d3d38ba71d8b510a7c0901b5ec67d
252b6ee1280907ce8e15c72a78288f333e6453cd
d95cb5b42d435543bf930101ee9c5ea08ca13c8418367ae5ed8415b23ecbb420
GET /upload/circlek2022-box2.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/png
content-length: 3503
x-guploader-uploadid: ADPycdvCQi1KO-7nMm3gMSs-igpg04g-1g8Q13PK6y1FFQcRc5obkxx-FISy32rYr3YpMCr3ln4WV5eL1CLmCpv6XiBUJQ
x-goog-generation: 1668579688341446
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 3503
x-goog-hash: crc32c=LdzWqQ==, md5=9k09OLpx2LUQp8CQG17GfQ==
x-goog-storage-class: STANDARD
expires: Fri, 16 Dec 2022 15:11:28 GMT
cache-control: public, max-age=14400
last-modified: Wed, 16 Nov 2022 06:21:28 GMT
etag: "f64d3d38ba71d8b510a7c0901b5ec67d"
cf-cache-status: HIT
age: 2375
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FlMzMdiGdkjpxJ39BrFNRu%2BumjcPiG8C5ltPGbLmBjj27zVrZhP%2BOZbEi9nXPOUfvruDQ9AVjZRDXaJmGsDQxJCfZTlU%2B%2FjS9hjrsU3prubPFagY6vhFSyFD8Voh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86466cd8b71d2-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/%C5%9E%C9%99bn%C9%99m%20%C6%8Fhm%C9%99dova.jpg
172.64.198.12200 OK 22 kB URL HTTP/2 263cdn.com/upload/%C5%9E%C9%99bn%C9%99m%20%C6%8Fhm%C9%99dova.jpg
IP 172.64.198.12:0
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x300, components 3\012- data
Hash 8b1c293d7c0b396a2bd2313ea3d36266
e7c4114b8c68b4b4e380c8d329f74137588285bc
b8ccc5a20664ab39207d1b89b241aba814dfd2fd71e3ac33c92dd2190ca2df59
GET /upload/%C5%9E%C9%99bn%C9%99m%20%C6%8Fhm%C9%99dova.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 22380
x-guploader-uploadid: ADPycdtpO5IM9KQc5BJ1afrKKQNMfRaeCVf5E_HBc9kkYJ9cn9Ld-Qxzwqn4DeiwlGtODZ-tyIY0AnwaHoSPHzLo4R4Ifw
expires: Fri, 16 Dec 2022 14:58:12 GMT
cache-control: public, max-age=14400
last-modified: Wed, 15 Jun 2022 21:45:12 GMT
etag: "8b1c293d7c0b396a2bd2313ea3d36266"
x-goog-generation: 1655329512877575
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 22380
x-goog-hash: crc32c=DaZ+eA==, md5=ixwpPXwLOWor0jE+o9NiZg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2406
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C%2BgFX13uqhT6O73Qk2XFVBy85TVFsFNI4KHeZNy36BHXlt9gO9KS44GO7hD0BFm%2BeO2JE9sfnUPyJ%2BjU8iN37qPQnP9zAA8a0uFXSeYQI%2Fcn9F9dNbZ%2BAjVPUp%2BZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86466c9e9750d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdnbun.com/upload/rossmannpl-m.png
172.64.164.25200 OK 16 kB URL HTTP/2 cdnbun.com/upload/rossmannpl-m.png
IP 172.64.164.25:0
File type PNG image data, 263 x 60, 8-bit/color RGBA, non-interlaced\012- data
Hash fe237c8a8fc0c6f5dea8391d29f65c76
7477dff6ffbecb91b2a19aa1417e6276223bd832
20226f8575f34c600b1531866171cc3f2366caacc92b5c150b8e733cbdfe15e7
GET /upload/rossmannpl-m.png HTTP/1.1
Host: cdnbun.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/png
content-length: 16060
x-guploader-uploadid: ADPycds2RYuwMQllX-fv0snEfh4OJzh-IQ9yAzjAb4vknxv5BT8vzcdcGz_nGfJiRNMOZyyfEucszVWWCcZc63KEcfhR7A
expires: Fri, 16 Dec 2022 15:12:19 GMT
cache-control: public, max-age=14400
last-modified: Fri, 25 Nov 2022 12:28:48 GMT
etag: "fe237c8a8fc0c6f5dea8391d29f65c76"
x-goog-generation: 1669379328124096
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 16060
x-goog-hash: crc32c=Pazbjg==, md5=/iN8io/AxvXeqDkdKfZcdg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2376
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OmqPrDJkB4Ty2zcn4bqfaS8%2F4%2FUQo2byZ%2FwCM0c0pgyhLFn629ViGSUn3xLIxQWuUyO1HFkPokPumDJ9a4DRG1kVAqt75HZVyhS5HBKZvH%2B%2BhkwGLFhkT9O4PtzA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86466cd9271d2-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/halzzpp.jpg
172.64.198.12200 OK 11 kB URL HTTP/2 263cdn.com/upload/halzzpp.jpg
IP 172.64.198.12:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 150x150, components 3\012- data
Hash 78e02192412ab37dbee64bd0ba5a550c
6a689b57a3f5ea53e65b18d472c503a8f44ae71f
ce580e987852055424603d0b6d8d3dce93ec101cc5248af91ad02a2332e393a4
GET /upload/halzzpp.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 11266
x-guploader-uploadid: ADPycds04fIB-wWMkEMhETGC6Vud5qMHtJcvHYnKxhsfBpjdD9PA-9A42cdQ623m63d58qSm-_RMiLmsvmH3oNlH3ijFBMyECyhC
expires: Fri, 16 Dec 2022 14:49:43 GMT
cache-control: public, max-age=14400
last-modified: Wed, 15 Jun 2022 21:54:12 GMT
etag: "78e02192412ab37dbee64bd0ba5a550c"
x-goog-generation: 1655330052237346
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 11266
x-goog-hash: crc32c=DyZFog==, md5=eOAhkkEqs32+5kvQulpVDA==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 3267
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4ED%2BOmjufkRsZWOZy4Z3152wOrA%2FBknyLM4elSmzzrJP%2F3I%2Fd9K747tlZ7vYvwNRhmw5zlT9tZcNJuXdHIaN3rDTtR%2Bzla%2BY7qm68XCLRZ54JNlkWTMTdcxONNpi"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86466c9ea750d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
263cdn.com/upload/deguos.jpg
172.64.198.12200 OK 15 kB URL HTTP/2 263cdn.com/upload/deguos.jpg
IP 172.64.198.12:0
File type JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=3, software=Adobe Photoshop 21.2 (Windows), datetime=2022-02-24T18:34+08:00], baseline, precision 8, 150x150, components 3\012- data
Hash fe141322f140a8d95e502fa48b3359e1
4cecbb8dcd14ca0339ac72a00a7b6e374053f7a5
56c075f4b04bdb89c9a52e0558e2663250fd842cf53394536f373e8e630fd9e5
GET /upload/deguos.jpg HTTP/1.1
Host: 263cdn.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: image/jpeg
content-length: 14651
x-guploader-uploadid: ADPycduBvOplHMGQRLPsr8lkl748Z9oSVURevfGxW7EwS3GxOk0bS7Xcj-1Mvz2JwTwpzK2NUobXBUPbQjkR4ey_unwkslKf9KbH
expires: Fri, 16 Dec 2022 15:16:54 GMT
cache-control: public, max-age=14400
last-modified: Wed, 15 Jun 2022 21:51:43 GMT
etag: "fe141322f140a8d95e502fa48b3359e1"
x-goog-generation: 1655329903020228
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 14651
x-goog-hash: crc32c=hz0rVA==, md5=/hQTIvFAqNleUC+kizNZ4Q==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 133
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9pzCXzE05trqgjWH5tdyWXiqsxNZCpme0fgp3V2hqe77FY9HwIATHuFjTlnu7C6vC4lJAUAIT%2FGjymOJi%2BSetepR9fOiB4ctRa5MQwkkMSSsykhxbK2TvUhuicRW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86466c9ec750d-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
1.bp.blogspot.com/-6OjTtrMq588/YKsjbL-wmoI/AAAAAAAABhs/UuUHtZD40v4QF-PMdm29IuYEYXf1-gCCwCLcBGAsYHQ/s16000/Norway_outbox.png
142.250.74.161200 OK 181 kB URL HTTP/2 1.bp.blogspot.com/-6OjTtrMq588/YKsjbL-wmoI/AAAAAAAABhs/UuUHtZD40v4QF-PMdm29IuYEYXf1-gCCwCLcBGAsYHQ/s16000/Norway_outbox.png
IP 142.250.74.161:0
File type PNG image data, 497 x 308, 8-bit/color RGBA, non-interlaced\012- data
Size 181 kB (180954 bytes)
Hash fd835c1f326d3e7da0d9839550f66723
5004618bc15011d7d0f569f60f900d076b164b3d
b2286c3ed452ee4eeb15d2044a90cfc456d4789b2fdbe42bb9e023c9da18e4a8
GET /-6OjTtrMq588/YKsjbL-wmoI/AAAAAAAABhs/UuUHtZD40v4QF-PMdm29IuYEYXf1-gCCwCLcBGAsYHQ/s16000/Norway_outbox.png HTTP/1.1
Host: 1.bp.blogspot.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-expose-headers: Content-Length
content-disposition: inline;filename="Norway_outbox.png"
vary: Origin
access-control-allow-origin: *
timing-allow-origin: *
x-content-type-options: nosniff
server: fife
content-length: 180954
x-xss-protection: 0
date: Fri, 16 Dec 2022 14:23:18 GMT
expires: Sun, 06 Nov 2022 03:02:48 GMT
cache-control: public, max-age=86400, no-transform
age: 3314
etag: "v632"
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
e1.o.lencr.org/
23.33.119.27200 OK 346 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 439abd0da745dff868023e4e06352d07
8b31bb240c46b32c29d70b9c6b6bd4968e0efabf
255fbdec7c6936a59e22531c7b11d54d2390fa139d054d18f341508f2faabbe6
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "255FBDEC7C6936A59E22531C7B11D54D2390FA139D054D18F341508F2FAABBE6"
Last-Modified: Thu, 15 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18985
Expires: Fri, 16 Dec 2022 20:34:57 GMT
Date: Fri, 16 Dec 2022 15:18:32 GMT
Connection: keep-alive
e1.o.lencr.org/
23.33.119.27200 OK 345 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash b54bf9e0002f097d1febc358bccc5453
5fa732fa887dd41ac90113dd680d57976eb19677
cd4cded2cc7e36324a82d71f4a3456d0d22bfa3ac2d36507fbc638900570f4f9
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "CD4CDED2CC7E36324A82D71F4A3456D0D22BFA3AC2D36507FBC638900570F4F9"
Last-Modified: Thu, 15 Dec 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13906
Expires: Fri, 16 Dec 2022 19:10:18 GMT
Date: Fri, 16 Dec 2022 15:18:32 GMT
Connection: keep-alive
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 471 B IP 142.250.74.131:0
Hash 0d73d5422599531ed89c2eb046ae6d8d
aac2f93511367405370fb6d69ec0a404c5903718
7ccd935f876d67f1da32b45f81ec4e81a76d7db490b9407490f6de24d14bed18
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash 142400be99b933ea5e0c68ea6a6b3e89
80e94132940e5ebe69dd0a03396764127b8fda49
20e8cde3c6907a3c5d97fe9fbcf6a44035e1f7482f7e166adb2c38a30a9084ea
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2750
Cache-Control: max-age=153250
Content-Type: application/ocsp-response
Date: Fri, 16 Dec 2022 15:18:32 GMT
Etag: "639c352c-1d7"
Expires: Sun, 18 Dec 2022 09:52:42 GMT
Last-Modified: Fri, 16 Dec 2022 09:06:52 GMT
Server: ECS (ska/F71D)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
44.228.207.167101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 44.228.207.167:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: DZ3Dzfu61kW+1O8dWbjrdw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: gbmw/I9eE/D5dgqscHCvpbQ+B3g=
ocsp.globalsign.com/gsrsaovsslca2018
104.18.20.226200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsrsaovsslca2018
IP 104.18.20.226:0
Hash fc10e32c15c10a42061a5c59cbd3a810
a3b1bc4437c4e1076f80681b69c6721dda3c65b3
b79b3cee3b008e911beeb5cfc0bb5f128f1ccc0744c7ce487e8a5dfbc5168e29
POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 16 Dec 2022 15:18:33 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Tue, 20 Dec 2022 13:44:43 GMT
ETag: "a3b1bc4437c4e1076f80681b69c6721dda3c65b3"
Last-Modified: Fri, 16 Dec 2022 13:44:44 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2853
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77a8646a49d4b503-OSL
ocsp.globalsign.com/gsrsaovsslca2018
104.18.20.226200 OK 1.4 kB URL HTTP/1.1 ocsp.globalsign.com/gsrsaovsslca2018
IP 104.18.20.226:0
Hash fc10e32c15c10a42061a5c59cbd3a810
a3b1bc4437c4e1076f80681b69c6721dda3c65b3
b79b3cee3b008e911beeb5cfc0bb5f128f1ccc0744c7ce487e8a5dfbc5168e29
POST /gsrsaovsslca2018 HTTP/1.1
Host: ocsp.globalsign.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Fri, 16 Dec 2022 15:18:33 GMT
Content-Type: application/ocsp-response
Content-Length: 1432
Connection: keep-alive
Expires: Tue, 20 Dec 2022 13:44:43 GMT
ETag: "a3b1bc4437c4e1076f80681b69c6721dda3c65b3"
Last-Modified: Fri, 16 Dec 2022 13:44:44 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2853
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77a8646a59e0b503-OSL
uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
185.66.200.220200 OK 898 B URL HTTP/2 uprimp.com/bnr.php?section=General&pub=593174&format=300x50&ga=g
IP 185.66.200.220:0
ASN #201702 skHosting.eu s.r.o.
Hash aec5587b7029be5fc9c055bc0f068520
c272924a363119190748bf8436d069159c9b82f6
093ffc9caf746dba615a90b1e0afd745d2ec282d7ffb03a4a6a622a590f0a512
GET /bnr.php?section=General&pub=593174&format=300x50&ga=g HTTP/1.1
Host: uprimp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: application/javascript
expires: Fri, 16 Dec 2022 15:18:32 GMT
last-modified: Fri, 16 Dec 2022 15:18:32 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-robots-tag: noindex, nofollow, noarchive, nosnippet
X-Firefox-Spdy: h2
region1.google-analytics.com/g/collect?v=2&tid=G-YP3DQB03D8>m=2oebu0&_p=2144095413&cid=771714962.1671203910&ul=en-us&sr=1280x1024&_s=1&sid=1671203909&sct=1&seg=0&dl=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807&dr=http%3A%2F%2Fm.z1oxncm.cn%2F&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
216.239.34.36204 No Content 58 B URL HTTP/2 region1.google-analytics.com/g/collect?v=2&tid=G-YP3DQB03D8>m=2oebu0&_p=2144095413&cid=771714962.1671203910&ul=en-us&sr=1280x1024&_s=1&sid=1671203909&sct=1&seg=0&dl=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807&dr=http%3A%2F%2Fm.z1oxncm.cn%2F&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
IP 216.239.34.36:0
Hash 20398ec55ee15ff8df35fa056e748c85
89a5dda35bf3a9cc5f9366a7fc215e02536ded0e
78091701217012c604069865fe78315d131c7c37776ec4b522ef100db2075217
POST /g/collect?v=2&tid=G-YP3DQB03D8>m=2oebu0&_p=2144095413&cid=771714962.1671203910&ul=en-us&sr=1280x1024&_s=1&sid=1671203909&sct=1&seg=0&dl=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807&dr=http%3A%2F%2Fm.z1oxncm.cn%2F&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 HTTP/1.1
Host: region1.google-analytics.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://utupkf.cyou
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 204 No Content
access-control-allow-origin: https://utupkf.cyou
date: Fri, 16 Dec 2022 15:18:33 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
hm.baidu.com/hm.js?b521817f22507716e364b3fe28644f8b
103.235.46.191200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?b521817f22507716e364b3fe28644f8b
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (657)
Hash 09a1f013b797a57ecba169472403f67d
87efa7ec434c309e57a26523a8bf4315c945ead1
cb1bb7d1d38bd6b9fb1f04c8cf8a01fcb0434db610e020d55627b2e712bcb1b1
GET /hm.js?b521817f22507716e364b3fe28644f8b HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11295
Content-Type: application/javascript
Date: Fri, 16 Dec 2022 15:18:33 GMT
Etag: dcf2293f73639231b6f7343fc54e116c
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=C7E86A19D6576078; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
hm.baidu.com/hm.js?395922a2c2d3c1e7bf4dab28bcfa2a1a
103.235.46.191200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?395922a2c2d3c1e7bf4dab28bcfa2a1a
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (673)
Hash 8c570bd45a7e28ab954a89a4639c8aad
00e7dec9e0ff55c20dc5f0657a3500c03660353b
4e5348af627d6df7d5f2464f005b074d20b535ea5918e3ec0d86413bc9b947bd
GET /hm.js?395922a2c2d3c1e7bf4dab28bcfa2a1a HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11311
Content-Type: application/javascript
Date: Fri, 16 Dec 2022 15:18:33 GMT
Etag: 05f15f32f5b630c04c73884688466de5
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=141C8B3DEA918850; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 0e5a8cf5962c05bf28a3b45f5c8745e2
9c5d7e8aeab26f9fd2e753ab4dc65d6fa8ea955f
f614642045fcd0ee373ed6cabe67514f4bb54c7fb4f1181b52eaec12d7e0479e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F614642045FCD0EE373ED6CABE67514F4BB54C7FB4F1181B52EAEC12D7E0479E"
Last-Modified: Thu, 15 Dec 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18530
Expires: Fri, 16 Dec 2022 20:27:24 GMT
Date: Fri, 16 Dec 2022 15:18:34 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 0e5a8cf5962c05bf28a3b45f5c8745e2
9c5d7e8aeab26f9fd2e753ab4dc65d6fa8ea955f
f614642045fcd0ee373ed6cabe67514f4bb54c7fb4f1181b52eaec12d7e0479e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F614642045FCD0EE373ED6CABE67514F4BB54C7FB4F1181B52EAEC12D7E0479E"
Last-Modified: Thu, 15 Dec 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18530
Expires: Fri, 16 Dec 2022 20:27:24 GMT
Date: Fri, 16 Dec 2022 15:18:34 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 0e5a8cf5962c05bf28a3b45f5c8745e2
9c5d7e8aeab26f9fd2e753ab4dc65d6fa8ea955f
f614642045fcd0ee373ed6cabe67514f4bb54c7fb4f1181b52eaec12d7e0479e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F614642045FCD0EE373ED6CABE67514F4BB54C7FB4F1181B52EAEC12D7E0479E"
Last-Modified: Thu, 15 Dec 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18530
Expires: Fri, 16 Dec 2022 20:27:24 GMT
Date: Fri, 16 Dec 2022 15:18:34 GMT
Connection: keep-alive
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 0e5a8cf5962c05bf28a3b45f5c8745e2
9c5d7e8aeab26f9fd2e753ab4dc65d6fa8ea955f
f614642045fcd0ee373ed6cabe67514f4bb54c7fb4f1181b52eaec12d7e0479e
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F614642045FCD0EE373ED6CABE67514F4BB54C7FB4F1181B52EAEC12D7E0479E"
Last-Modified: Thu, 15 Dec 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18530
Expires: Fri, 16 Dec 2022 20:27:24 GMT
Date: Fri, 16 Dec 2022 15:18:34 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fad9b3731-4e58-4b83-86cf-7f2ecd6c4eb1.jpeg
34.120.237.76200 OK 10 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fad9b3731-4e58-4b83-86cf-7f2ecd6c4eb1.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash cab96eaa42941683dff4d1b6b093c007
ba5269c77dd0422ab275c9a3529fb2e1a1af6bc3
4fe48e9a35a50b7ae88f4b4de67aa82c4acbbe43aab655921f7bacb5524789f1
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fad9b3731-4e58-4b83-86cf-7f2ecd6c4eb1.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 10132
x-amzn-requestid: 9484ad87-61cb-40e5-9823-930ec9925e02
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dH-dXEfTIAMFZQw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63997788-5dea61195ba653a87915845d;Sampled=0
x-amzn-remapped-date: Wed, 14 Dec 2022 07:13:12 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: VImsv72dpcwiDXWm67XU-rpUEuO5CMDwFs00DA9C6l-sKX5e2ChsQA==
via: 1.1 e291f351a18746d40754b367095a2872.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 16 Dec 2022 06:51:09 GMT
age: 30445
etag: "ba5269c77dd0422ab275c9a3529fb2e1a1af6bc3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62fa3452-e15b-41dd-b257-cd6d8cfaea78.jpeg
34.120.237.76200 OK 5.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62fa3452-e15b-41dd-b257-cd6d8cfaea78.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c89c607de35e59fa4b8f79762af0f269
362e1b907abcaccb16b3750c21ed04e4fa91f04c
7b9a28ad984bc7544d0798ff38cf8e1ce9f2f21a0112c18ee127a7566ba683e4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F62fa3452-e15b-41dd-b257-cd6d8cfaea78.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 5791
x-amzn-requestid: 2fb8518c-1fe3-426e-94ed-eea686005473
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dNRKYHeoIAMFgKA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-639b9575-0e312c40469090d033c6fc6a;Sampled=0
x-amzn-remapped-date: Thu, 15 Dec 2022 21:45:25 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: -baQ_JUiZDWWBIizZVrOZrXdHTSgQbIJubNqHqA7Zjj-eKTvCNfKSg==
via: 1.1 470e3fe246a660ba6ace67a79f78d246.cloudfront.net (CloudFront), 1.1 6a9b42e38e76b7d4a4044ebe0e0eca08.cloudfront.net (CloudFront), 1.1 google
date: Thu, 15 Dec 2022 22:09:08 GMT
age: 61766
etag: "362e1b907abcaccb16b3750c21ed04e4fa91f04c"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33ea75fa-e30c-4f7a-b0f6-24942168a508.jpeg
34.120.237.76200 OK 11 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33ea75fa-e30c-4f7a-b0f6-24942168a508.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 83be48c5771e071d94ac0d912357ac99
97e31d3e2c268fe9335e1111bd2eb8cc9dd729d1
dc7eaffae4521f6bc297ce21c0abe99fe92bf8938266b550f8e38ff9705bdeda
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F33ea75fa-e30c-4f7a-b0f6-24942168a508.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 11196
x-amzn-requestid: 1bcdd4c6-14db-40bc-90aa-226a0e411a09
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dNQQJFFeIAMFQgQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-639b9400-65c676d06a24e0252e8828dc;Sampled=0
x-amzn-remapped-date: Thu, 15 Dec 2022 21:39:12 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: clnZ4iIDmF0oSqQv7wWwYt-KHO6U1Lp7hz706oDCBLhP3szyWQiDLw==
via: 1.1 f13aef0c4b52f6f681401f232d03eb68.cloudfront.net (CloudFront), 1.1 3cd7af07832481c336aa1c93c9b4a6fe.cloudfront.net (CloudFront), 1.1 google
date: Thu, 15 Dec 2022 22:08:33 GMT
age: 61801
etag: "97e31d3e2c268fe9335e1111bd2eb8cc9dd729d1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff22fa4a3-ba63-491d-a915-4c7ea375f720.jpeg
34.120.237.76200 OK 7.9 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff22fa4a3-ba63-491d-a915-4c7ea375f720.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 1439b219bc14c22c96fdba089d03dc40
bfe8173cae5e2c8fa781f11661dc0893fc159eb3
a5aad1c8c3464232f0bb74c8115ea0cb0d2ac6f43c5418feb967803ea8286ff3
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Ff22fa4a3-ba63-491d-a915-4c7ea375f720.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7896
x-amzn-requestid: cf094f2f-ce6b-4626-8168-36944d557cb7
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dHbA4FexoAMFe-g=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63993ed2-60e1d5f53f3d2ad01060a8d4;Sampled=0
x-amzn-remapped-date: Wed, 14 Dec 2022 03:11:14 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: mll3QERZM31KbfZHDwBbhVAn07NlWeRTNTL4hVyHXp1ctwbk-_Djjg==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Fri, 16 Dec 2022 04:14:19 GMT
age: 39855
etag: "bfe8173cae5e2c8fa781f11661dc0893fc159eb3"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe34f6337-b00d-4487-82ce-cbed5b4f3f4f.jpeg
34.120.237.76200 OK 7.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe34f6337-b00d-4487-82ce-cbed5b4f3f4f.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 0d2294cdacdc84b8b19874ba56035a6d
53009a81b15e464d5529d36b1e04b841b2ae034e
67d59aa026b43ed3f698f3853b986fc7c07e4e6e5f7b3551e59238f79978480a
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fe34f6337-b00d-4487-82ce-cbed5b4f3f4f.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7616
x-amzn-requestid: 71bbe208-11e3-4280-bf09-bff8bd18fcb4
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: c82fXGmPoAMF3Og=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63950462-12393ca432808b7f0b2771dc;Sampled=0
x-amzn-remapped-date: Sat, 10 Dec 2022 22:12:50 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: G1MopDnv-WOAbIBMe0v-V9xXeJIVDReKWSMG33dQt1q5GpK41RU0PQ==
via: 1.1 00f0a41f749793b9dd653153037c957e.cloudfront.net (CloudFront), 1.1 559326ad73233233a9e52cb9e8601ede.cloudfront.net (CloudFront), 1.1 google
date: Fri, 16 Dec 2022 07:15:01 GMT
age: 29013
etag: "53009a81b15e464d5529d36b1e04b841b2ae034e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F119528a5-7370-4990-b83c-626c858ba99d.webp
34.120.237.76200 OK 8.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F119528a5-7370-4990-b83c-626c858ba99d.webp
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 20c9788db0532c15e2d42faffc192bba
5051c939cdedb14e313d7413c0dff5fa0eab50ea
0a2e782b848394b167d6e2a9b521be11d473e96048de715a22bd6afaf7c58057
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F119528a5-7370-4990-b83c-626c858ba99d.webp HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8601
x-amzn-requestid: f3be9b43-d8d9-4862-b06a-bac1de46d2c1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: dNQ84Hh6oAMFRGw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-639b951f-3b85d738211ce0ff0f8e6e74;Sampled=0
x-amzn-remapped-date: Thu, 15 Dec 2022 21:43:59 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: ZISFRsj2Nq7L27qJheQ33qkfyNdG5_q6S6BcV-dGgcUmvPnYUS2FmA==
via: 1.1 01c28b52813cd0e82f810c492808b142.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Thu, 15 Dec 2022 22:09:03 GMT
age: 61771
etag: "5051c939cdedb14e313d7413c0dff5fa0eab50ea"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
hm.baidu.com/hm.js?c7f1b3f152598f901bc0aad793b18b59
103.235.46.191200 OK 11 kB URL HTTP/1.1 hm.baidu.com/hm.js?c7f1b3f152598f901bc0aad793b18b59
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type ASCII text, with very long lines (620)
Hash 7b35b949f65e7881b1eadcf6fa2febf1
b1ae75ea17c82e0e2b39a5617f133ac60785592a
6b39043350d853f91c18eb36e72861bc64e1723a22899846fc5a3123e341b983
GET /hm.js?c7f1b3f152598f901bc0aad793b18b59 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: max-age=0, must-revalidate
Content-Encoding: gzip
Content-Length: 11258
Content-Type: application/javascript
Date: Fri, 16 Dec 2022 15:18:33 GMT
Etag: 8c6112c68c87c889b51dd06eaa6897a5
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Server: apache
Set-Cookie: HMACCOUNT=031A731963115D7A; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
bonepa.com/js/responsive.js
185.66.201.42200 OK 12 kB URL HTTP/2 bonepa.com/js/responsive.js
IP 185.66.201.42:0
ASN #201702 skHosting.eu s.r.o.
Hash 1f93707feee85af002951d1c8dc88704
bc5236bfc87d88ef9e3011a8552878435f030af0
65869491af2229250cadcb60eff16d8b46d32f1b4fd43db8f11566d3ac04f235
Analyzer Verdict Alert fortinet Phishing
GET /js/responsive.js HTTP/1.1
Host: bonepa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: application/javascript
last-modified: Wed, 02 Nov 2022 13:52:39 GMT
etag: W/"63627627-e32"
content-encoding: br
X-Firefox-Spdy: h2
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=439889502&si=b521817f22507716e364b3fe28644f8b&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61411&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266
103.235.46.191200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=439889502&si=b521817f22507716e364b3fe28644f8b&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61411&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=439889502&si=b521817f22507716e364b3fe28644f8b&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61411&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Fri, 16 Dec 2022 15:18:34 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=9754D29A3037F379; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1612140346&si=395922a2c2d3c1e7bf4dab28bcfa2a1a&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61411&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266
103.235.46.191200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1612140346&si=395922a2c2d3c1e7bf4dab28bcfa2a1a&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61411&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=1612140346&si=395922a2c2d3c1e7bf4dab28bcfa2a1a&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61411&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Fri, 16 Dec 2022 15:18:34 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=B06CA5AB9E7E1212; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=174152960&si=c7f1b3f152598f901bc0aad793b18b59&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61411&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266
103.235.46.191200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=174152960&si=c7f1b3f152598f901bc0aad793b18b59&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61411&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=174152960&si=c7f1b3f152598f901bc0aad793b18b59&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61411&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Fri, 16 Dec 2022 15:18:34 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=A38A3FD4B54B736E; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=981170513&si=e580d24a0af01241d534439cfcc0c10c&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61412&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266
103.235.46.191200 OK 43 B URL HTTP/1.1 hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=981170513&si=e580d24a0af01241d534439cfcc0c10c&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61412&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266
IP 103.235.46.191:0
ASN #55967 Beijing Baidu Netcom Science and Technology Co., Ltd.
File type GIF image data, version 89a, 1 x 1\012- data
Hash ad4b0f606e0f8465bc4c4c170b37e1a3
50b30fd5f87c85fe5cba2635cb83316ca71250d7
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
GET /hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=939&et=0&ja=0&ln=en-us&lo=0&rnd=981170513&si=e580d24a0af01241d534439cfcc0c10c&su=http%3A%2F%2Fm.z1oxncm.cn%2F&v=1.3.0&lv=1&sn=61412&r=0&ww=1280&u=https%3A%2F%2Futupkf.cyou%2FWUJUAmhv%2Frossmannpl-maq2022%2F%3F_t%3D1671203911741lookms1671200943807%231671203910266 HTTP/1.1
Host: hm.baidu.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Length: 43
Content-Type: image/gif
Date: Fri, 16 Dec 2022 15:18:34 GMT
P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: apache
Set-Cookie: HMACCOUNT=F47A904BFF26BA63; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT
Strict-Transport-Security: max-age=172800
X-Content-Type-Options: nosniff
r3.o.lencr.org/
95.101.11.115200 OK 503 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash 47b22de4f16c6a29079b7334c6e29363
05f4f9fa784ef7d132fd5950cadd0bd6e9dbb959
ace932be771977ed1efded66e262efc35a60249acb9101489bedf6e5035cc823
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "ACE932BE771977ED1EFDED66E262EFC35A60249ACB9101489BEDF6E5035CC823"
Last-Modified: Thu, 15 Dec 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=8261
Expires: Fri, 16 Dec 2022 17:36:16 GMT
Date: Fri, 16 Dec 2022 15:18:35 GMT
Connection: keep-alive
o-oo.ooo/ad_images/logo.png
185.66.201.42200 OK 3.5 kB URL HTTP/2 o-oo.ooo/ad_images/logo.png
IP 185.66.201.42:0
ASN #201702 skHosting.eu s.r.o.
File type PNG image data, 190 x 60, 8-bit/color RGBA, non-interlaced\012- data
Hash e95afa59b2ea9f0d6544497914ce0188
29fd2964672fa3b4c1baa35f51c54bc66cfb5360
98902df6fa68e142a296a10902051761ca496231253230773d9c95bc40c0724c
GET /ad_images/logo.png HTTP/1.1
Host: o-oo.ooo
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://bonepa.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Fri, 16 Dec 2022 15:18:35 GMT
content-type: image/png
content-length: 3483
last-modified: Mon, 10 Oct 2022 14:02:52 GMT
etag: "6344260c-d9b"
expires: Fri, 23 Dec 2022 15:18:35 GMT
cache-control: max-age=604800
accept-ranges: bytes
X-Firefox-Spdy: h2
bonepa.com/4fe48aebd6/4f59451604/?placementName=Pop&is_first=true&randomA=0_3341&maxw=0
185.66.201.42200 OK 18 kB URL HTTP/2 bonepa.com/4fe48aebd6/4f59451604/?placementName=Pop&is_first=true&randomA=0_3341&maxw=0
IP 185.66.201.42:0
ASN #201702 skHosting.eu s.r.o.
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (14072)
Hash 43b5b25260bf5f7ef8737d75c6a22afc
f949e1b39d0000fb9dcfcaf27a03fe9709aaf05d
48b951ca12c089d0d00163dc74deeb44f3e8c9e84dfc0b5db8a68028e59dbe8d
GET /4fe48aebd6/4f59451604/?placementName=Pop&is_first=true&randomA=0_3341&maxw=0 HTTP/1.1
Host: bonepa.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 16 Dec 2022 15:18:34 GMT
content-type: text/html; charset=UTF-8
set-cookie: shown1=0; expires=Sat, 17-Dec-2022 15:18:34 GMT; Max-Age=86400; secure; SameSite=None
used_ad2823101=1; expires=Sat, 17-Dec-2022 04:59:59 GMT; Max-Age=49285; path=/; secure; SameSite=None
total_impressions=1; expires=Sat, 17-Dec-2022 04:59:59 GMT; Max-Age=49285; secure; SameSite=None
expires: Sun, 01 Jan 2014 00:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-robots-tag: noindex,nofollow
access-control-allow-origin: *
content-encoding: br
X-Firefox-Spdy: h2
utupkf.cyou/WUJUAmhv/rossmannpl-maq2022/?_t=1671203911741lookms1671200943807
172.67.183.174200 OK 0 B URL HTTP/2 utupkf.cyou/WUJUAmhv/rossmannpl-maq2022/?_t=1671203911741lookms1671200943807
IP 172.67.183.174:0
Analyzer Verdict Alert fortinet Phishing
quad9 Sinkholed
GET /WUJUAmhv/rossmannpl-maq2022/?_t=1671203911741lookms1671200943807 HTTP/1.1
Host: utupkf.cyou
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://m.z1oxncm.cn/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
set-cookie: pType=mo; expires=Fri, 16-Dec-2022 15:30:32 GMT; Max-Age=720; path=/; domain=utupkf.cyou
rossmannpl-maq2022-tthh1=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.utupkf.cyou
rossmannpl-maq2022-tthh2=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.utupkf.cyou
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qGragVLoa%2FWU3vtmHIgRTq%2BJ%2BmFU6%2BszOofBbqh%2BL4jVcBSiYT63jyi5EV6hvYH0DLPd3aBGPFYgty8dDH90vf%2BRAjWUikymmmlI%2BQMPWfdIp8IVvfHAZ8vDwcD1Eg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77a86462eb2ab524-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
172.67.151.125200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/bootstrap@4.6.0/dist/js/bootstrap.min.js
IP 172.67.151.125:0
GET /npm/bootstrap@4.6.0/dist/js/bootstrap.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycdv0chj5F1Awc6K7Usaiie2qXL87Fxg5kp7mYqQH9s8HWV5Nuv0HuTqJ2hz1F5xUG9MGapUfK4P-pfLXRasYr-w
expires: Fri, 16 Dec 2022 15:23:12 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:36:54 GMT
etag: W/"c99230d2575380d7f95ff626606d2426"
x-goog-generation: 1647502614200576
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 63473
x-goog-hash: crc32c=x2l+AA==, md5=yZIw0ldTgNf5X/YmYG0kJg==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2339
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OkCoXHS5S4K4tkNcQ5mS5xrERluxfmq9Qvfh%2Bs5RsOzFO%2F0upFoj9flw3o%2BLNaI62JTKd1L3reTebfiyt5SmZVD4%2BvoWIg8nv144jp3F2TZ2wbRUSvKvJfos8Q4T%2B3om7U0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86464cecf0b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
172.67.151.125200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/lazyload@2.0.0-rc.2/lazyload.min.js
IP 172.67.151.125:0
GET /npm/lazyload@2.0.0-rc.2/lazyload.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycdsQwI6S5jC2ZwwNbaEnMvjelWJ3GXYdnwkp6yGGRsWcMv2CGKN45430-s2v57JOsXldQJq3rMwQOTmm_DkHtW4
x-goog-generation: 1647502963816044
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 4798
x-goog-hash: crc32c=lted8w==, md5=3G3pgTxxS6mXM8pPtdOh+g==
x-goog-storage-class: STANDARD
expires: Fri, 16 Dec 2022 15:21:52 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:42:43 GMT
etag: W/"dc6de9813c714ba99733ca4fb5d3a1fa"
cf-cache-status: HIT
age: 2338
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g1PqfrlXeUbWjR1dK8Sfr3Z8O2eOtpkZ19BKKJolrkbeLyU6YxE1oQHSvcKtpVJqFrso4dspWIPX2jEOQDaiiWlhoyiLuvfkiW0XCvBj3lWtY8x%2FOQRhieb%2FdB5mcFu0ZRU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86464fefd0b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
www.googletagmanager.com/gtag/js?id=G-YP3DQB03D8
172.217.21.168200 OK 0 B URL HTTP/2 www.googletagmanager.com/gtag/js?id=G-YP3DQB03D8
IP 172.217.21.168:0
GET /gtag/js?id=G-YP3DQB03D8 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Fri, 16 Dec 2022 15:18:32 GMT
expires: Fri, 16 Dec 2022 15:18:32 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 76334
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
uprimp.com/bnr_xload.php?section=General&pub=593174&format=300x50&ga=g&xt=167120391270423&xtt=3298236
185.66.200.220200 OK 0 B URL HTTP/2 uprimp.com/bnr_xload.php?section=General&pub=593174&format=300x50&ga=g&xt=167120391270423&xtt=3298236
IP 185.66.200.220:0
ASN #201702 skHosting.eu s.r.o.
GET /bnr_xload.php?section=General&pub=593174&format=300x50&ga=g&xt=167120391270423&xtt=3298236 HTTP/1.1
Host: uprimp.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
TE: trailers
HTTP/2 200 OK
server: nginx
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: text/html; charset=UTF-8
expires: Fri, 16 Dec 2022 15:18:32 GMT
last-modified: Fri, 16 Dec 2022 15:18:32 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-robots-tag: noindex, nofollow, noarchive, nosnippet
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
172.67.151.125200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/popper.js@1.16.1/dist/umd/popper.min.js
IP 172.67.151.125:0
GET /npm/popper.js@1.16.1/dist/umd/popper.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycdt8iAiFUD-J6NleyhXb8_vV8-wAPh_5tba_l2ugugXdkSJbrWiN1EsoSHZyahG4iSEJB_zV100HdRQRWXjd72Q
expires: Fri, 16 Dec 2022 14:19:13 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:44:44 GMT
etag: W/"31c898c6d2ea13c30441657ff1900d81"
x-goog-generation: 1647503084523089
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 21236
x-goog-hash: crc32c=7cW0Gg==, md5=MciYxtLqE8MEQWV/8ZANgQ==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2338
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FdJNRyMjiaRt6QodS7YNL%2BCiCgYF1%2FfTqWmMa4ZzV6vKzLGiW4HECRDmHJr85f2K%2FVzrWQf%2Bm65ekZNLZ3bYDfeNagzG0u29tsiTSp00WCk%2FI90g18NdW7AN6HHtZjkj4SU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86464bec10b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2
cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
172.67.151.125200 OK 0 B URL HTTP/2 cdn.jsdelivr.cc/npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js
IP 172.67.151.125:0
GET /npm/sweetalert2@10.16.0/dist/sweetalert2.all.min.js HTTP/1.1
Host: cdn.jsdelivr.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://utupkf.cyou/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
date: Fri, 16 Dec 2022 15:18:32 GMT
content-type: text/javascript
x-guploader-uploadid: ADPycds_5oPtcr3KFpC_u7Lnvdlqz8VeCGxAgHcXFP3zMljDMh6Q0ifyAwrLV7e0dbEbUBwQbF9kY0g0GrHWdqicRh8
expires: Fri, 16 Dec 2022 15:17:28 GMT
cache-control: public, max-age=3600
last-modified: Thu, 17 Mar 2022 07:40:39 GMT
etag: W/"80924b62e5b3ac73aa4849776b439770"
x-goog-generation: 1647502839791727
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 72765
x-goog-hash: crc32c=8ZRUYw==, md5=gJJLYuWzrHOqSEl3a0OXcA==
x-goog-storage-class: STANDARD
cf-cache-status: HIT
age: 2339
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xqoTxfA6UwAu6zOQ7HqbJbz30KfC4aortLOWi9VRTD2hCFL%2BnIANe6tgljyjR55PJUf0%2FiC7%2BNZEbaM5%2FdtG7HPb6UhNoxgUWsdJjFch0AeesBZ2HlXQaxBKbCC3%2FtZ6fLA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77a86464ced60b49-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2